Data Processing Agreement (template)

This is a template. Have counsel review it and replace bracketed placeholders before use.

1. Parties

Controller: the practice named in the DocChase account (“Customer”). Processor: [Company legal name] (“DocChase”). This DPA applies to personal data processed by DocChase on behalf of Customer through the service.

2. Subject matter and duration

DocChase processes client names, contact details and documents uploaded through portal links for the duration of the subscription, plus the retention period configured by the Customer.

3. Instructions

DocChase processes personal data only to provide the service and on documented instructions from the Customer, including the settings chosen in the app (reminders, retention, branding).

4. Confidentiality

Personnel with access to personal data are bound by confidentiality obligations and access is limited to what is necessary for support and operations.

5. Security measures

• Unique 256-bit portal tokens, expiry and revocation, HMAC signature verification.
• File validation by magic bytes and allow-list MIME types; malware scanner extension point.
• Tenant isolation enforced in queries plus a service-layer guard, with regression tests.
• Encryption in transit (TLS) and at rest for object storage (AES-256 or provider equivalent).
• Audit logs for uploads, downloads, exports and account changes.
• Rate limiting on the portal and authentication endpoints.
• Least-privilege database credentials and environment secret management.

6. Subprocessors

Hosting, PostgreSQL, S3-compatible object storage, Resend (email), Paddle (payments), Sentry (monitoring) and Plausible (analytics, optional). The list is maintained in the privacy policy. DocChase gives notice of material changes and the Customer may object.

7. Data subject requests

The service provides per-client ZIP exports and account deletion. DocChase assists the Customer in responding to access, rectification, erasure and portability requests.

8. Breach notification

DocChase notifies the Customer without undue delay, and no later than 72 hours after becoming aware of a personal data breach, with the information reasonably available.

9. Audits

On request, DocChase provides documentation of security controls and answers reasonable security questionnaires. On-site audits are available with reasonable notice and confidentiality.

10. Return and deletion

On termination, the Customer can export data before deletion. DocChase deletes personal data within 30 days unless law requires retention, and confirms deletion on request.

11. International transfers

Transfers outside the EEA/UK rely on Standard Contractual Clauses and subprocessor DPAs.

12. Liability and governing law

Liability is subject to the main services agreement. This DPA is governed by the law stated there.